diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
index 373a6d6..0408f49 100644
--- a/.github/workflows/playwright.yml
+++ b/.github/workflows/playwright.yml
@@ -4,9 +4,9 @@ on:
   push:
     branches:
       - main
-  pull_request:
-    branches:
-      - main
+    paths:
+      - 'src/**'
+      - 'package-lock.json'
   workflow_dispatch:
 
 jobs:
diff --git a/.husky/pre-commit b/.husky/pre-commit
index f409ca8..9cc4a90 100755
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1,4 +1,5 @@
 #!/usr/bin/env sh
-set -euo pipefail
+set -eu
+if (set -o pipefail) 2>/dev/null; then :; fi
 
 npx lint-staged
diff --git a/.husky/pre-push b/.husky/pre-push
index 30968cb..9e36a84 100755
--- a/.husky/pre-push
+++ b/.husky/pre-push
@@ -1,5 +1,6 @@
 #!/usr/bin/env sh
-set -euo pipefail
+set -eu
+if (set -o pipefail) 2>/dev/null; then :; fi
 
 npm run prettier:check
 npm run lint
diff --git a/README.md b/README.md
index 8ffbb23..ecda302 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,7 @@ A runtime JSX template tag backed by the [`oxc-parser`](https://github.com/oxc-p
 - [Next.js integration](#nextjs-integration)
 - [Browser usage](#browser-usage)
 - [Testing & demos](#testing)
+- [CLI setup](docs/cli.md)
 
 ## Installation
 
@@ -34,12 +35,14 @@ npm install @knighted/jsx
 > [!NOTE]
 > Planning to use the React runtime (`@knighted/jsx/react`)? Install `react@>=18` and `react-dom@>=18` alongside this package so the helper can create elements and render them through ReactDOM.
 
-The parser automatically uses native bindings when it runs in Node.js. To enable the WASM binding for browser builds you also need the `@oxc-parser/binding-wasm32-wasi` package. Because npm enforces the `cpu: ["wasm32"]` flag you must opt into the install explicitly:
+The parser automatically uses native bindings when it runs in Node.js. To enable the WASM binding for browser builds you also need the `@oxc-parser/binding-wasm32-wasi` package. The quickest path is:
 
 ```sh
-npm_config_ignore_platform=true npm install @oxc-parser/binding-wasm32-wasi
+npx @knighted/jsx init
 ```
 
+See [docs/cli.md](docs/cli.md) for flags, dry runs, and package-manager overrides. If you prefer manual install, run `npm_config_ignore_platform=true npm install @oxc-parser/binding-wasm32-wasi`.
+
 > [!TIP]
 > Public CDNs such as `esm.sh` or `jsdelivr` already publish bundles that include the WASM binding, so you can import this package directly from those endpoints in `<script type="module">` blocks without any extra setup.
 
diff --git a/docs/cli.md b/docs/cli.md
new file mode 100644
index 0000000..ca3f95b
--- /dev/null
+++ b/docs/cli.md
@@ -0,0 +1,53 @@
+# CLI: init
+
+The `init` command installs the WASM parser binding and helper runtimes for `@knighted/jsx`. It defaults to a safe path that only installs and verifies the binding—it will not change your bundler config unless you explicitly opt in.
+
+## Quick start
+
+```sh
+npx @knighted/jsx init
+```
+
+What it does by default:
+
+- Installs `@oxc-parser/binding-wasm32-wasi` plus runtime helpers (`@napi-rs/wasm-runtime`, `@emnapi/runtime`, `@emnapi/core`).
+- Records the binding in `optionalDependencies` so the version is visible in your project.
+- Verifies the binding can be imported and reports the resolved path.
+- Skips loader config changes (prompted only when you opt in).
+
+## Options
+
+- `--package-manager`, `--pm <npm|pnpm|yarn|bun>`: override detection.
+- `--wasm-package <spec>`: install a different binding spec (or set `WASM_BINDING_PACKAGE`).
+- `--config`: prompt for loader help (no automatic edits yet; shows guidance only).
+- `--skip-config`: skip loader help (default).
+- `--dry-run`: print what would happen without executing.
+- `--force`, `--yes`: assume "yes" for prompts.
+- `--verbose`: show additional detail (commands, resolve paths).
+
+Examples:
+
+```sh
+# Default install + verification
+npx @knighted/jsx init
+
+# Dry run with verbose logging
+npx @knighted/jsx init --dry-run --verbose
+
+# Force npm even if a different lockfile is present
+npx @knighted/jsx init --pm npm
+
+# Prompt for loader guidance after install
+npx @knighted/jsx init --config
+
+# Use a custom binding build
+WASM_BINDING_PACKAGE=@oxc-parser/binding-wasm32-wasi@^0.100.0 npx @knighted/jsx init
+```
+
+## Notes
+
+- The command uses `npm pack` internally to pull the WASM binding even when it is marked for `cpu: ["wasm32"]`.
+- Loader configuration is opt-in and requires a prompt. No config files are modified unless you request help.
+- If verification fails, rerun with `--verbose` to see the resolved binding path and error details.
+- `@tybys/wasm-util` is not required for the standard flow. Consider it only as an advanced workaround if your environment blocks the normal WASM install/loading path.
+- Bundlers may need a WASM-friendly setting to emit the parser asset: Vite handles `.wasm` out of the box; Webpack/Rspack typically need `experiments.asyncWebAssembly = true` or an asset rule so `parser.wasm32-wasi.wasm` is copied into the build output. Ensure your bundler is configured to serve that file.
diff --git a/eslint.config.js b/eslint.config.js
index c0ca488..046040e 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -44,6 +44,12 @@ export default [
       'n/no-unpublished-require': 'off',
     },
   },
+  {
+    files: ['src/cli/**/*', 'scripts/**/*'],
+    rules: {
+      'n/no-process-exit': 'off',
+    },
+  },
   {
     files: ['test/fixtures/**/*'],
     rules: {
diff --git a/package-lock.json b/package-lock.json
index 02a3ec8..4566e38 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,16 +1,20 @@
 {
   "name": "@knighted/jsx",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@knighted/jsx",
-      "version": "1.2.1",
+      "version": "1.3.0",
       "license": "MIT",
       "dependencies": {
         "magic-string": "^0.30.21",
-        "oxc-parser": "^0.99.0"
+        "oxc-parser": "^0.99.0",
+        "tar": "^7.4.3"
+      },
+      "bin": {
+        "jsx": "dist/cli/init.js"
       },
       "devDependencies": {
         "@eslint/js": "^9.39.1",
@@ -35,7 +39,6 @@
         "prettier": "^3.7.3",
         "react": "^19.0.0",
         "react-dom": "^19.0.0",
-        "tar": "^7.4.3",
         "tsup": "^8.5.1",
         "typescript": "^5.9.3",
         "typescript-eslint": "^8.48.0",
@@ -43,7 +46,7 @@
         "vitest": "^4.0.14"
       },
       "engines": {
-        "node": ">=22.3.0"
+        "node": ">=22.17.0"
       },
       "optionalDependencies": {
         "@oxc-parser/binding-darwin-arm64": "^0.99.0",
@@ -1595,7 +1598,6 @@
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
       "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
-      "dev": true,
       "license": "ISC",
       "dependencies": {
         "minipass": "^7.0.4"
@@ -3874,7 +3876,6 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
       "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
-      "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=18"
@@ -5798,7 +5799,6 @@
       "version": "7.1.2",
       "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
       "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
-      "dev": true,
       "license": "ISC",
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -5808,7 +5808,6 @@
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
       "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "minipass": "^7.1.2"
@@ -7138,7 +7137,6 @@
       "version": "7.5.2",
       "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.2.tgz",
       "integrity": "sha512-7NyxrTE4Anh8km8iEy7o0QYPs+0JKBTj5ZaqHg6B39erLg0qYXN3BijtShwbsNSvQ+LN75+KV+C4QR/f6Gwnpg==",
-      "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "@isaacs/fs-minipass": "^4.0.0",
@@ -8349,7 +8347,6 @@
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
       "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
-      "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=18"
diff --git a/package.json b/package.json
index 90db9ca..c18a3b4 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@knighted/jsx",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Runtime JSX tagged template that renders DOM or React trees anywhere without a build step.",
   "keywords": [
     "jsx runtime",
@@ -17,6 +17,9 @@
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "bin": {
+    "jsx": "./dist/cli/init.js"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -65,11 +68,11 @@
     "./package.json": "./package.json"
   },
   "engines": {
-    "node": ">=22.3.0"
+    "node": ">=22.17.0"
   },
   "engineStrict": true,
   "scripts": {
-    "build": "duel && npm run build:lite",
+    "build": "duel && npm run build:lite && npm run build:cli",
     "prepare": "husky",
     "precheck-types": "npm run build",
     "check-types": "npm run check-types:lib && npm run check-types:demo",
@@ -78,8 +81,8 @@
     "lint": "eslint src test",
     "prettier": "prettier -w .",
     "prettier:check": "prettier --check .",
-    "test": "vitest run --coverage",
-    "test:watch": "vitest",
+    "test": "KNIGHTED_JSX_CLI_TEST=1 vitest run --coverage",
+    "test:watch": "KNIGHTED_JSX_CLI_TEST=1 vitest",
     "test:e2e": "npm run build && npm run setup:wasm && npm run build:fixture && playwright test",
     "build:fixture": "node scripts/build-rspack-fixture.mjs",
     "demo:node-ssr": "node test/fixtures/node-ssr/render.mjs",
@@ -87,6 +90,7 @@
     "build:demo": "vite build --config vite.config.ts",
     "preview": "vite preview --config vite.config.ts",
     "build:lite": "tsup --config tsup.config.ts",
+    "build:cli": "tsup --config tsup.cli.config.ts",
     "setup:wasm": "node scripts/setup-wasm.mjs",
     "prepack": "npm run build"
   },
@@ -113,7 +117,6 @@
     "prettier": "^3.7.3",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "tar": "^7.4.3",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.48.0",
@@ -122,7 +125,8 @@
   },
   "dependencies": {
     "magic-string": "^0.30.21",
-    "oxc-parser": "^0.99.0"
+    "oxc-parser": "^0.99.0",
+    "tar": "^7.4.3"
   },
   "peerDependencies": {
     "jsdom": "*",
diff --git a/scripts/setup-wasm.mjs b/scripts/setup-wasm.mjs
index 83ab324..e2904c4 100644
--- a/scripts/setup-wasm.mjs
+++ b/scripts/setup-wasm.mjs
@@ -1,4 +1,4 @@
-import { execFileSync } from 'node:child_process'
+import { execFileSync, spawnSync } from 'node:child_process'
 import fs from 'node:fs'
 import path from 'node:path'
 import { extract } from 'tar'
@@ -6,6 +6,16 @@ import { extract } from 'tar'
 const PACKAGE_SPEC =
   process.env.WASM_BINDING_PACKAGE ?? '@oxc-parser/binding-wasm32-wasi@^0.99.0'
 const cwd = process.cwd()
+const cliEntry = path.resolve(cwd, 'dist', 'cli', 'init.js')
+
+if (fs.existsSync(cliEntry)) {
+  const result = spawnSync(process.execPath, [cliEntry, '--skip-config', '--force'], {
+    cwd,
+    stdio: 'inherit',
+  })
+
+  process.exit(result.status ?? 0)
+}
 
 function runNpmPack() {
   const output = execFileSync('npm', ['pack', PACKAGE_SPEC], {
diff --git a/src/cli/init.ts b/src/cli/init.ts
new file mode 100644
index 0000000..61ad3ec
--- /dev/null
+++ b/src/cli/init.ts
@@ -0,0 +1,348 @@
+import { execFileSync, spawnSync } from 'node:child_process'
+import fs from 'node:fs'
+import path from 'node:path'
+import readline from 'node:readline/promises'
+import { createRequire } from 'node:module'
+import { pathToFileURL } from 'node:url'
+import { extract } from 'tar'
+
+const DEFAULT_BINDING_SPEC =
+  process.env.WASM_BINDING_PACKAGE ?? '@oxc-parser/binding-wasm32-wasi@^0.99.0'
+const RUNTIME_DEPS = ['@napi-rs/wasm-runtime', '@emnapi/runtime', '@emnapi/core']
+const SUPPORTED_PACKAGE_MANAGERS = ['npm', 'pnpm', 'yarn', 'bun'] as const
+
+type PackageManager = (typeof SUPPORTED_PACKAGE_MANAGERS)[number]
+
+type CliOptions = {
+  cwd: string
+  dryRun: boolean
+  verbose: boolean
+  force: boolean
+  skipConfig: boolean
+  packageManager?: PackageManager
+  wasmPackage: string
+}
+
+function parseArgs(argv: string[]): CliOptions {
+  const options: CliOptions = {
+    cwd: process.cwd(),
+    dryRun: false,
+    verbose: false,
+    force: false,
+    skipConfig: true,
+    wasmPackage: DEFAULT_BINDING_SPEC,
+  }
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i]
+    if (arg === '--dry-run') {
+      options.dryRun = true
+    } else if (arg === '--verbose') {
+      options.verbose = true
+    } else if (arg === '--force' || arg === '--yes') {
+      options.force = true
+    } else if (arg === '--skip-config') {
+      options.skipConfig = true
+    } else if (arg === '--config') {
+      options.skipConfig = false
+    } else if (arg === '--package-manager' || arg === '--pm') {
+      const pm = argv[i + 1]
+      if (!pm) throw new Error('Missing value for --package-manager')
+      if (!SUPPORTED_PACKAGE_MANAGERS.includes(pm as PackageManager)) {
+        throw new Error(`Unsupported package manager: ${pm}`)
+      }
+      options.packageManager = pm as PackageManager
+      i += 1
+    } else if (arg === '--wasm-package') {
+      const pkg = argv[i + 1]
+      if (!pkg) throw new Error('Missing value for --wasm-package')
+      options.wasmPackage = pkg
+      i += 1
+    } else if (arg === '--help' || arg === '-h') {
+      printHelp()
+      process.exit(0)
+    }
+  }
+
+  return options
+}
+
+function printHelp() {
+  console.log(
+    `\nUsage: npx @knighted/jsx init [options]\n\nOptions:\n  --package-manager, --pm <name>  Choose npm | pnpm | yarn | bun\n  --wasm-package <spec>           Override binding package spec\n  --config                        Prompt to help with loader config\n  --skip-config                   Skip any loader config prompts (default)\n  --dry-run                       Print actions without executing\n  --force, --yes                  Assume yes for prompts\n  --verbose                       Log extra detail\n  -h, --help                      Show this help message\n`,
+  )
+}
+
+function log(message: string) {
+  console.log(message)
+}
+
+function logVerbose(message: string, verbose: boolean) {
+  if (verbose) console.log(message)
+}
+
+function detectPackageManager(cwd: string, explicit?: PackageManager): PackageManager {
+  if (explicit) return explicit
+
+  const ua = process.env.npm_config_user_agent ?? ''
+  if (ua.startsWith('pnpm')) return 'pnpm'
+  if (ua.startsWith('yarn')) return 'yarn'
+  if (ua.startsWith('bun')) return 'bun'
+
+  const lookups: Record<PackageManager, string> = {
+    pnpm: 'pnpm-lock.yaml',
+    yarn: 'yarn.lock',
+    bun: 'bun.lockb',
+    npm: 'package-lock.json',
+  }
+
+  for (const [pm, lockfile] of Object.entries(lookups) as Array<
+    [PackageManager, string]
+  >) {
+    if (fs.existsSync(path.join(cwd, lockfile))) return pm
+  }
+
+  return 'npm'
+}
+
+function ensurePackageJson(cwd: string) {
+  const pkgPath = path.join(cwd, 'package.json')
+  if (!fs.existsSync(pkgPath)) {
+    throw new Error('No package.json found. Run this inside a project with package.json.')
+  }
+}
+
+function runNpmPack(spec: string, cwd: string, dryRun: boolean, verbose: boolean) {
+  logVerbose(`> npm pack ${spec}`, verbose)
+  if (dryRun) return `${spec.replace(/\W+/g, '_')}.tgz`
+
+  const output = execFileSync('npm', ['pack', spec], {
+    cwd,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'inherit'],
+  }).trim()
+
+  const lines = output.split('\n').filter(Boolean)
+  return lines[lines.length - 1]
+}
+
+function parsePackageName(spec: string) {
+  const match = spec.match(/^(@?[^@\s]+\/[^@\s]+|@?[^@\s]+)(?:@(.+))?$/)
+  if (!match) return { name: spec, version: undefined }
+  const [, name, version] = match
+  return { name, version }
+}
+
+async function installBinding(
+  spec: string,
+  cwd: string,
+  dryRun: boolean,
+  verbose: boolean,
+): Promise<{ targetDir: string; tarballPath?: string; name: string; version?: string }> {
+  const { name, version } = parsePackageName(spec)
+  const tarballName = runNpmPack(spec, cwd, dryRun, verbose)
+  const tarballPath = path.resolve(cwd, tarballName)
+  const targetDir = path.resolve(cwd, 'node_modules', ...name.split('/'))
+
+  log(`> Installing ${spec} into ${targetDir}`)
+  if (!dryRun) {
+    fs.rmSync(targetDir, { recursive: true, force: true })
+    fs.mkdirSync(targetDir, { recursive: true })
+    await extract({ file: tarballPath, cwd: targetDir, strip: 1 })
+    fs.rmSync(tarballPath, { force: true })
+  }
+
+  return { targetDir, tarballPath: dryRun ? undefined : tarballPath, name, version }
+}
+
+function installRuntimeDeps(
+  pm: PackageManager,
+  deps: string[],
+  cwd: string,
+  dryRun: boolean,
+  verbose: boolean,
+) {
+  const missing = deps.filter(dep => !isDependencyInstalled(dep, cwd))
+  if (missing.length === 0) {
+    log('> Runtime dependencies already present; skipping install')
+    return []
+  }
+
+  const commands: Record<PackageManager, [string, string[]]> = {
+    npm: ['npm', ['install', ...missing, '--save']],
+    pnpm: ['pnpm', ['add', ...missing]],
+    yarn: ['yarn', ['add', ...missing]],
+    bun: ['bun', ['add', ...missing]],
+  }
+
+  const [command, args] = commands[pm]
+  logVerbose(`> ${command} ${args.join(' ')}`, verbose)
+  if (!dryRun) {
+    const result = spawnSync(command, args, { cwd, stdio: 'inherit' })
+    if (result.status !== 0) {
+      throw new Error(`Failed to install runtime dependencies with ${pm}`)
+    }
+  }
+
+  return missing
+}
+
+function isDependencyInstalled(dep: string, cwd: string) {
+  try {
+    const requireFromCwd = createRequire(path.join(cwd, 'package.json'))
+    requireFromCwd.resolve(dep)
+    return true
+  } catch {
+    return false
+  }
+}
+
+function persistBindingSpec(
+  cwd: string,
+  name: string,
+  version: string | undefined,
+  dryRun: boolean,
+  verbose: boolean,
+) {
+  if (!version) {
+    logVerbose('> Skipping package.json update (no version parsed)', verbose)
+    return
+  }
+
+  const pkgPath = path.join(cwd, 'package.json')
+  const pkgRaw = fs.readFileSync(pkgPath, 'utf8')
+  const pkgJson = JSON.parse(pkgRaw)
+  pkgJson.optionalDependencies = pkgJson.optionalDependencies ?? {}
+  pkgJson.optionalDependencies[name] = version
+
+  log(`> Recording optionalDependency ${name}@${version}`)
+  if (!dryRun) {
+    fs.writeFileSync(pkgPath, `${JSON.stringify(pkgJson, null, 2)}\n`, 'utf8')
+  }
+}
+
+async function verifyBinding(
+  name: string,
+  cwd: string,
+  verbose: boolean,
+): Promise<string> {
+  const requireFromCwd = createRequire(path.join(cwd, 'package.json'))
+  const resolved = requireFromCwd.resolve(name)
+  logVerbose(`> Resolved ${name} to ${resolved}`, verbose)
+
+  const imported = await import(pathToFileURL(resolved).href)
+  if (!imported) {
+    throw new Error(`Imported ${name} is empty; verification failed`)
+  }
+
+  return resolved
+}
+
+async function promptYesNo(prompt: string, defaultValue: boolean, force: boolean) {
+  if (!process.stdin.isTTY) return defaultValue
+  if (force) return true
+
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout })
+  const suffix = defaultValue ? '[Y/n]' : '[y/N]'
+  const answer = await rl.question(`${prompt} ${suffix} `)
+  await rl.close()
+
+  if (!answer.trim()) return defaultValue
+  const normalized = answer.trim().toLowerCase()
+  return normalized === 'y' || normalized === 'yes'
+}
+
+async function maybeHandleConfigPrompt(skipConfig: boolean, force: boolean) {
+  if (skipConfig) {
+    log('> Skipping loader config (default). Re-run with --config to opt in.')
+    return
+  }
+
+  const wantsHelp = await promptYesNo(
+    'Do you want help adding loader configuration now?',
+    false,
+    force,
+  )
+
+  if (!wantsHelp) {
+    log('> Skipping loader config per your choice.')
+    return
+  }
+
+  log(
+    '> Loader assistance is interactive and not applied automatically yet. See docs at docs/cli.md for next steps.',
+  )
+}
+
+async function main() {
+  const options = parseArgs(process.argv.slice(2))
+  ensurePackageJson(options.cwd)
+
+  const packageManager = detectPackageManager(options.cwd, options.packageManager)
+  log(`> Using package manager: ${packageManager}`)
+
+  const installedRuntimeDeps = installRuntimeDeps(
+    packageManager,
+    RUNTIME_DEPS,
+    options.cwd,
+    options.dryRun,
+    options.verbose,
+  )
+
+  const binding = await installBinding(
+    options.wasmPackage,
+    options.cwd,
+    options.dryRun,
+    options.verbose,
+  )
+
+  persistBindingSpec(
+    options.cwd,
+    binding.name,
+    binding.version,
+    options.dryRun,
+    options.verbose,
+  )
+
+  let resolvedPath: string | undefined
+  if (!options.dryRun) {
+    resolvedPath = await verifyBinding(binding.name, options.cwd, options.verbose)
+    log(`> Verified ${binding.name} at ${resolvedPath}`)
+  }
+
+  await maybeHandleConfigPrompt(options.skipConfig, options.force)
+
+  log('\nDone!')
+  log(`- Binding: ${binding.name}${binding.version ? `@${binding.version}` : ''}`)
+  log(`- Target: ${binding.targetDir}`)
+  log(
+    `- Runtime deps installed: ${installedRuntimeDeps.join(', ') || 'none (already present)'}`,
+  )
+  if (resolvedPath) log(`- Verified import: ${resolvedPath}`)
+}
+
+if (process.env.KNIGHTED_JSX_CLI_TEST !== '1') {
+  main().catch(error => {
+    console.error(
+      'Failed to set up WASM binding:',
+      error instanceof Error ? error.message : error,
+    )
+    process.exitCode = 1
+  })
+}
+
+export {
+  parseArgs,
+  detectPackageManager,
+  ensurePackageJson,
+  runNpmPack,
+  parsePackageName,
+  installBinding,
+  installRuntimeDeps,
+  isDependencyInstalled,
+  persistBindingSpec,
+  verifyBinding,
+  promptYesNo,
+  maybeHandleConfigPrompt,
+  main,
+}
diff --git a/test/cli-init.test.ts b/test/cli-init.test.ts
new file mode 100644
index 0000000..1d877a7
--- /dev/null
+++ b/test/cli-init.test.ts
@@ -0,0 +1,214 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { beforeAll, describe, expect, it, vi } from 'vitest'
+import { create } from 'tar'
+
+let cli: typeof import('../src/cli/init')
+
+beforeAll(async () => {
+  process.env.KNIGHTED_JSX_CLI_TEST = '1'
+  cli = await import('../src/cli/init')
+})
+
+describe('parseArgs', () => {
+  it('parses defaults and flags', () => {
+    const result = cli.parseArgs([
+      '--dry-run',
+      '--verbose',
+      '--force',
+      '--config',
+      '--package-manager',
+      'pnpm',
+      '--wasm-package',
+      '@custom/pkg@1.0.0',
+    ])
+
+    expect(result.dryRun).toBe(true)
+    expect(result.verbose).toBe(true)
+    expect(result.force).toBe(true)
+    expect(result.skipConfig).toBe(false)
+    expect(result.packageManager).toBe('pnpm')
+    expect(result.wasmPackage).toBe('@custom/pkg@1.0.0')
+  })
+})
+
+describe('detectPackageManager', () => {
+  it('detects from lockfiles', () => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'jsx-cli-pm-'))
+    const hadUA = Object.prototype.hasOwnProperty.call(
+      process.env,
+      'npm_config_user_agent',
+    )
+    const originalUA = process.env.npm_config_user_agent
+    process.env.npm_config_user_agent = ''
+    const npmLock = path.join(tmp, 'package-lock.json')
+    fs.writeFileSync(npmLock, '{}')
+    expect(cli.detectPackageManager(tmp)).toBe('npm')
+    fs.unlinkSync(npmLock)
+
+    const pnpmLock = path.join(tmp, 'pnpm-lock.yaml')
+    fs.writeFileSync(pnpmLock, '')
+    expect(cli.detectPackageManager(tmp)).toBe('pnpm')
+
+    if (hadUA) {
+      process.env.npm_config_user_agent = originalUA
+    } else {
+      delete process.env.npm_config_user_agent
+    }
+  })
+})
+
+describe('installRuntimeDeps', () => {
+  it('returns missing deps without installing when dry-run', () => {
+    const missing = cli.installRuntimeDeps(
+      'npm',
+      ['dep-a', 'dep-b'],
+      process.cwd(),
+      true,
+      true,
+    )
+    expect(missing).toEqual(['dep-a', 'dep-b'])
+  })
+
+  it('skips when deps already installed', () => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'jsx-cli-installed-'))
+    fs.mkdirSync(path.join(tmp, 'node_modules', 'dep-a'), { recursive: true })
+    fs.writeFileSync(
+      path.join(tmp, 'node_modules', 'dep-a', 'index.js'),
+      'module.exports = {}',
+    )
+    fs.writeFileSync(
+      path.join(tmp, 'package.json'),
+      JSON.stringify({ name: 'tmp', version: '0.0.0' }),
+    )
+
+    const missing = cli.installRuntimeDeps('npm', ['dep-a'], tmp, false, false)
+    expect(missing).toEqual([])
+  })
+})
+
+describe('installBinding + verifyBinding (dry-run)', () => {
+  it('packs and installs into target dir in dry-run mode', async () => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'jsx-cli-binding-'))
+
+    const packSpy = vi.spyOn(cli, 'runNpmPack').mockReturnValue('fake.tgz')
+
+    const result = await cli.installBinding('pkg@1.0.0', tmp, true, false)
+    expect(result.targetDir).toBe(path.join(tmp, 'node_modules', 'pkg'))
+    expect(result.tarballPath).toBeUndefined()
+
+    packSpy.mockRestore()
+  })
+
+  it('extracts tarball on real install', async () => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'jsx-cli-binding-real-'))
+    const tarballName = 'pkg-1.0.0.tgz'
+    const tarballPath = path.join(tmp, tarballName)
+
+    const payloadDir = path.join(tmp, 'payload')
+    fs.mkdirSync(path.join(payloadDir, 'package'), { recursive: true })
+    fs.writeFileSync(path.join(payloadDir, 'package', 'file.txt'), 'hello')
+    await create({ file: tarballPath, cwd: payloadDir }, ['package/file.txt'])
+
+    const packSpy = vi.spyOn(cli, 'runNpmPack').mockReturnValue(tarballName)
+
+    const result = await cli.installBinding('pkg', tmp, false, false)
+    expect(result.targetDir).toBe(path.join(tmp, 'node_modules', 'pkg'))
+    expect(fs.existsSync(result.targetDir)).toBe(true)
+
+    packSpy.mockRestore()
+  })
+})
+
+describe('verifyBinding (mocked)', () => {
+  it('attempts to resolve and import module', async () => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'jsx-cli-verify-'))
+    const pkgPath = path.join(tmp, 'package.json')
+    fs.writeFileSync(
+      pkgPath,
+      JSON.stringify({ name: 'tmp', version: '0.0.0', type: 'module' }, null, 2),
+    )
+
+    const modDir = path.join(tmp, 'node_modules', 'dummy')
+    fs.mkdirSync(modDir, { recursive: true })
+    const dummyModulePath = path.join(modDir, 'index.mjs')
+    fs.writeFileSync(dummyModulePath, 'export const ok = true')
+    fs.writeFileSync(
+      path.join(modDir, 'package.json'),
+      JSON.stringify({
+        name: 'dummy',
+        version: '0.0.0',
+        type: 'module',
+        main: './index.mjs',
+      }),
+    )
+
+    await expect(cli.verifyBinding('dummy', tmp, false)).resolves.toContain('index.mjs')
+  })
+})
+
+describe('persistBindingSpec', () => {
+  it('records optionalDependency', () => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'jsx-cli-pkg-'))
+    const pkgPath = path.join(tmp, 'package.json')
+    fs.writeFileSync(pkgPath, JSON.stringify({ name: 'tmp', version: '0.0.0' }, null, 2))
+
+    cli.persistBindingSpec(
+      tmp,
+      '@oxc-parser/binding-wasm32-wasi',
+      '^0.99.0',
+      false,
+      false,
+    )
+
+    const updated = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+    expect(updated.optionalDependencies['@oxc-parser/binding-wasm32-wasi']).toBe(
+      '^0.99.0',
+    )
+  })
+})
+
+describe('ensurePackageJson', () => {
+  it('throws when package.json missing', () => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'jsx-cli-missing-'))
+    expect(() => cli.ensurePackageJson(tmp)).toThrow(/No package.json/)
+  })
+})
+
+describe('maybeHandleConfigPrompt', () => {
+  it('skips when flag set', async () => {
+    const logs: string[] = []
+    const originalLog = console.log
+    console.log = msg => logs.push(String(msg))
+
+    await cli.maybeHandleConfigPrompt(true, false)
+
+    console.log = originalLog
+    expect(logs.some(line => line.includes('Skipping loader config'))).toBe(true)
+  })
+
+  it('logs helper message when opting in with force', async () => {
+    const logs: string[] = []
+    const originalLog = console.log
+    const originalTty = process.stdin.isTTY
+    ;(process.stdin as typeof process.stdin & { isTTY?: boolean }).isTTY = true
+    console.log = msg => logs.push(String(msg))
+
+    await cli.maybeHandleConfigPrompt(false, true)
+
+    console.log = originalLog
+    ;(process.stdin as typeof process.stdin & { isTTY?: boolean }).isTTY = originalTty
+    expect(logs.some(line => line.includes('Loader assistance is interactive'))).toBe(
+      true,
+    )
+  })
+})
+
+describe('runNpmPack', () => {
+  it('returns sanitized tarball name in dry-run', () => {
+    const name = cli.runNpmPack('@scope/pkg@1.0.0', '/tmp', true, false)
+    expect(name.endsWith('.tgz')).toBe(true)
+    expect(name.includes('@')).toBe(false)
+  })
+})
diff --git a/tsup.cli.config.ts b/tsup.cli.config.ts
new file mode 100644
index 0000000..e2faa6d
--- /dev/null
+++ b/tsup.cli.config.ts
@@ -0,0 +1,22 @@
+import { defineConfig } from 'tsup'
+
+export default defineConfig({
+  entry: {
+    init: 'src/cli/init.ts',
+  },
+  outDir: 'dist/cli',
+  format: ['esm'],
+  platform: 'node',
+  target: 'node22',
+  dts: false,
+  minify: false,
+  sourcemap: false,
+  splitting: false,
+  treeshake: true,
+  clean: false,
+  shims: false,
+  skipNodeModulesBundle: true,
+  banner: {
+    js: '#!/usr/bin/env node',
+  },
+})